andwur

Ownership of paintball guns is regulated under the state-level firearms act in most (all?) states and territories.

You can use them under the direct supervision of the licensed owner, but it's still quite restrictive. If you were to take one and shoot at cameras on the street it would vandalism plus firearms offences, most of which start at inversion of innocence, massive fines and move pretty quickly into prison time.

"Undrain" is not idiomatic, at least outside of Google. One might drain a tank or creek to empty it, the reverse isn't "undraining" to fill it back up. "issuance flow has been restored" might be a more widely understood phrasing.

Admittedly, a nitpick, however the tech industry has a tendency to invent new words when they could say the exact same thing in plain English and be better understood by a wider audience.

It's amusing that after all this time and (hundreds of?) billions of dollars invested in adtech I still find the adverts in old magazines far more relevant and compelling than any of the "personalised" adverts of today. The industry as a whole has missed the forest for the trees by over-fitting their systems; I might be interested in the broader category, or a tangentially related one, but at no point do I want to see the exact same product I was looking at a day ago on every ad. I didn't buy it then for a reason, so I'm not buying it now.

Pervasive surveillance to make a system that's practically worse than the alternative that doesn't require mass surveillance, and is much simpler and cheaper. Did I say amusing before? Depressing is probably a better fit.

That's inaccurate for standard thickness drywall sheet, which is usually a 20kg maximum parallel load (e.g. vertical for a wall) regardless of fixing method. Orthogonal load is even less. You might be able to attach a TV or cabinet but it would definitely not be safe, any additional weight or dynamic load would quite likely rip it off the wall with no warning.

The recommended approach for anything with moderate weight or above is to anchor to the studs and never rely on the drywall itself for retention.

One needs to only witness an exec team or board meeting to realise that loyalty as a concept doesn't exist at the top for the vast majority of companies. You're 1.8% of the accounts department budget, or 0.02% of the head office budget. Which is looking a bit high in the face of our projected earnings this quarter. Best get HR to trim that by 10% to free up some cashflow for sales and initiatives. Actually, make that 20%. Bonuses were a bit thin last round and I need a new yacht.

They could have taken a more defence-in-depth approach to key storage and encrypted the cloud copy of the Bitlocker key with a random master key itself protected by a user password-derived key arrangement, with any crypto action occuring on the device to avoid knowledge of the plaintext key. That way the Bitlocker key stored in the cloud is opaque to Microsoft, and only by knowing the user's current cleartext password could they access the raw Bitlocker key.

The current approach is weak, and strikes me as a design unlikely to be taken unless all the people involved were unfamiliar with secure design (unlikely IMO), or they intentionally left the door open to this type of access.

Considering the number of x86 machines I've come across in fleet deployments that were put into various states of brickdom from Windows Update, I would not be at all surprised if it was a bad update-rollback sequence.

Laptops seem particularly susceptible to whatever (anti) magic Microsoft utilise for their update rollback process, but it happens to every device class seemingly at random. Besides the run of the mill "corrupt files at random in System32", which is common and simple enough to fix with a clean install, I've had a few cases where it appears an attempt at rolling back a BIOS update has been interrupted by the rollback manager and left those machines hard bricked. They could only be recovered by flashing a clean BIOS image with an external programmer and clip (or hand soldering leads), after which they ran without issue.

As much as it's valid to question the unconditional anti-Microsoft mentality, they are still far from infallible and from my experience they are getting notably more unreliable in recent years.

Likely cheaper to just coat the real drones in an aerogel or similar light weight, high thermal resistance material. It's an arms race still, but one with a reasonable amount of asymmetry in favour of an attacker.

You likely ran into anti-fraud provisions with that scenario, specifically identity theft prevention. Having worked at a similar business for years, a trend for high fraud occurrence is squeaky clean credit file-high income applying for low value credit.

These have a well above average occurrence of identity theft cases, presumably because the guaranteed affordability test pass combined with low value makes it easy to get the loan and subsequently unlikely anyone will bother to chase it when they identify it as fraudulent.

It's easier, and cheaper, as a provider to just reject all originating accounts in this scenario. Similar to applying for a mortgage: if your credit parameters vastly mismatch your affordability you will get a LOT more questions asked.

I'm really interested in this too. I'm tossing up between something like this (maximum thread count but probably high power usage) or a Ryzen build (simple and low power).

That CPU has a TDP of 115W but I can't find much information on the idle power usage.

I would also like to see a write-up of the GPU pass-through setup since that's something I've been wanting to have on my local system for ages, i.e. vm host system => dev vm 1 ... vm N, Windows VM + dedicated GPU for gaming etc.

If they were a research organisation then I would have nothing but respect for Facebook's accomplishments. However they are not a research organisation but instead a for-profit corporation that devotes an obscene amount of money and effort to undermining privacy for all users of the internet, irrespective of whether you use their platform or not.

I don't think it's fair to judge the merits of an entity purely by what it brings to the world, without also considering what it in turn takes from it.

Well there's Watson [1]. It obviously performed very well in Jeopardy! and it sounds like they had some novel ideas and techniques behind the implementation.

I'm not sure how cool this is anymore however. Our company was evaluating their Bluemix [2] cloud all-the-things-as-a-service service which offers Watson. Despite their very aggressive marketing team insisting it would be able to solve a very wide range of "machine learning problems" (their words, not mine) it fell down quickly when encountering problems outside their example data-set. It was also impossible to get in touch with an engineer there, the only people you could speak to were sales and/or marketing which were useless. I get the feeling their desired clientele are technically illiterate upper-management who merely want the guarantee of a massive corporation's support and to hell with their technical capabilities.

[1] https://en.wikipedia.org/wiki/Watson_(computer) [2] https://www.ibm.com/cloud-computing/bluemix/

YMMV obviously but having used CyanogenMod for the past few years on various devices I've found it to generally exceed the stability of vendor-provided Android. Not to mention the better user experience and more rapid security patching.

If the included file is writable by the PHP user then I would say that poses a reasonably high security risk; potential privesc, information disclosure, RCE. Of course an attacker would need the ability to manipulate local files as the PHP user, but that isn't much of a stretch.

Under a typical install, e.g. Debian, Ubuntu, etc, nginx parses the configuration files as root thus any exploit of the config parser gains full root access as the nginx master process doesn't drop caps.

Depending on where the include line is placed it may be possible for an attacker to create server blocks allowing them to execute arbitrary PHP by permitting PHP execution from a directory with PHP write access, e.g. `wp-upload`. Assisting exfiltration of data by allowing easy remote access to the filesystem. Possibly proxy all traffic through an attacker controlled script or host. Exposing local services to the outside world.

I'm sure there's plenty of other interesting little attacks possible if given enough time to play around with it.

If at all possible I would avoid permitting unprivileged r|w access to nginx configuration files.

It cost me $250 ($100 of which was 300m of Cat6) and a very tedious, insulation filled, Sunday to wire my house up with 1Gbit ports in every room.

Comparing that to the price of the current batch of AC WiFi access points (that look like stealth bombers) I don't think it's too unreasonable.

I think they mean that viewing the costs induces gibbering in the viewer.

I would imagine so, particularly in cryptography, being able to view the source is not the same as being able to (easily) verify it doesn't contain any backdoors. See ECDSA as good example; we can see the entire standard and yet we can't be sure that it hasn't been weakened/backdoored by its creators despite it looking secure on the surface. See the start of [0], the bit about the standard pushing state leaking through secret dependent operations.

[0] https://blog.cr.yp.to/20140323-ecdsa.html

Edit: my point here is that America would have to trust that there was no way that the Russians had added backdoors. Given their history and the current political climate I can't see that trust coming soon.

Perhaps they feel the Note 7 name has been completely burnt (sorry!) in the public's eye and any attempt to salvage it at this point would cost them more than they could ever hope to recoup from further sales.

The only other thing I can think of is they've identified an issue with the phone itself that's causing this and either they or, more likely in my opinion, their insurance providers aren't willing to take the risk putting any more into the wild.

They appear to all be regular ZIP files that contain malware as opposed to ZIP files that are themselves malware.

1) security 2) annoyance 3) disagree with tracking 4) speed (rural internet yay!)

I find it particularly annoying when clients demand adverts on paid-product sites, i.e. they have a site which is fully funded by their sales but they want that tiny bit extra at a huge cost to site appearance and load times.

"Instagram is foodless"

You deviant!

Also it's Bouquet dear! Really...

"How dare you comment on the flaws found in someone's project!"

If issues are never brought to light then it's very unlikely they will ever be fixed. Would you rather everyone just stayed silent?

I have great respect for someone that can put in the time and effort to reverse engineer Skype, and brave Microsoft's legal team in doing so, but in its current state this code can't be used safely and is far from easy to understand either.

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure.

Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage.

[0] https://github.com/skypeopensource/skypeopensource2/blob/mas...

[1] https://github.com/skypeopensource/skypeopensource2/blob/mas...

[2] https://github.com/skypeopensource/skypeopensource2/blob/mas...

Not particularly. Besides the fact that was only one of many possible delivery vectors available, e.g. XSS, direct compromise of a visited site etc, it's one with quite a high chance of succeeding* in the wild.

* when the target isn't already paranoid due to previous attacks and the bait isn't quite so pathetic in its construction...

Edit: I imagine they went with the SMS method due to its high accuracy and low risk of detection from third parties.

Assuming I'm understanding you correctly you sent 11,000 emails in under 24 hours to 10-15 people? For a newly created account I could understand that raising a few red flags. Though that doesn't justify their support staff failing to respond to queries nor the immediate account termination.

I get the feeling they're having trouble with their sender reputation; one of our larger clients was recently switched to SparkPost from Mandrill ("it's too expensive!") and it's now a continual battle with delayed deliveries and mail being marked as spam. The issue never arose with Mandrill. (and yes, SPF and DKIM are correct)

If you're relying on crawlers to build your database how do you plan on dealing with spam traps? I see you have a verification aspect to your service but from what detail you have provided it would be incapable of distinguishing legitimate from trap.

Their presence in your lists could ultimately render the service useless as users risk blacklisting by contacting such addresses.